OTI: 一种无需模型且具有视觉解释性的图像攻击性度量方法
OTI: A Model-free and Visually Interpretable Measure of Image Attackability
AI总结：
本文提出OTI，一种无需模型且具有视觉解释性的图像攻击性度量方法，通过测量图像语义对象的纹理强度来评估图像攻击性，具有高效且可解释的优势。
摘要：
尽管神经网络取得了巨大成功，但良性图像可能被对抗扰动篡改以欺骗这些模型。有趣的是，图像在攻击性上存在差异。具体而言，给定一个攻击配置，一些图像容易被篡改，而另一些则更具有抵抗力。评估图像攻击性在主动学习、对抗训练和攻击增强中具有重要应用。这促使人们越来越关注开发攻击性度量方法。然而，现有方法稀缺且存在两个主要限制：(1) 它们依赖于模型代理提供先验知识（例如梯度或最小扰动）来提取模型依赖的图像特征。不幸的是，在实践中，许多任务特定模型并不容易获得。(2) 描述图像攻击性的提取特征缺乏视觉可解释性，模糊了它们与图像的直接关系。为了解决这些问题，我们提出了一种新颖的物体纹理强度（OTI），一种无需模型且具有视觉解释性的图像攻击性度量方法，将图像攻击性测量为图像语义对象的纹理强度。理论上，我们从决策边界以及对抗扰动的中高频特性角度描述了OTI的原理。全面的实验表明，OTI有效且计算高效。此外，我们的OTI为对抗机器学习社区提供了对攻击性的视觉理解。
英文摘要：
Despite the tremendous success of neural networks, benign images can be corrupted by adversarial perturbations to deceive these models. Intriguingly, images differ in their attackability. Specifically, given an attack configuration, some images are easily corrupted, whereas others are more resistant. Evaluating image attackability has important applications in active learning, adversarial training, and attack enhancement. This prompts a growing interest in developing attackability measures. However, existing methods are scarce and suffer from two major limitations: (1) They rely on a model proxy to provide prior knowledge (e.g., gradients or minimal perturbation) to extract model-dependent image features. Unfortunately, in practice, many task-specific models are not readily accessible. (2) Extracted features characterizing image attackability lack visual interpretability, obscuring their direct relationship with the images. To address these, we propose a novel Object Texture Intensity (OTI), a model-free and visually interpretable measure of image attackability, which measures image attackability as the texture intensity of the image's semantic object. Theoretically, we describe the principles of OTI from the perspectives of decision boundaries as well as the mid- and high-frequency characteristics of adversarial perturbations. Comprehensive experiments demonstrate that OTI is effective and computationally efficient. In addition, our OTI provides the adversarial machine learning community with a visual understanding of attackability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
